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Abstract 


Business  continuity  services  (BCS)  encompass  more  than  just  disaster 
recovery  (DR)  services.  As  logical  threats  pose  an  increasing  risk  to 
mission  critical  business  processes,  BCS  offerings  typically  include 
proactive  elements  which  seek  to  prevent  the  occurrence  of  logical 
disasters. 

INPUT  research  reveals  that  today's  U.S.  businesses  do  not  perceive 
physical  threats  such  as  floods  and  fires  to  be  the  main  threats  to  the 
continuity  of  their  business  activities.  Logical  threats  such  as  data 
security  and  hardware  and  software  failure  are  now  perceived  to  be  the 
major  threats  to  business  activities. 

Nevertheless,  the  BCS  market  is  worth  $1.4  billion  in  the  United  States 
and  will  be  worth  $3.2  biUion  by  2002,  growing  at  18%  CAGR. 

This  report  analyses  the  BCS  business  and  contains  information  which: 

•  Helps  vendors  to  understand  the  dynamics  affecting  the  BCS  market 

•  Reveals  ways  in  which  vendors  can  enjoy  continued  success  in  the 
BCS  market 

•  Equips  BCS  vendors  with  information  relating  to  user  attitudes 
towards  business  continuity  services 

•  Reveals  how  BCS  users  perceive  BCS  vendors. 
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Introduction 


A   ^  

Objectives  And  Scope 

Business  continuity  services  (BCS)  encompass  more  than  just  disaster 
recovery  (DR)  services.  As  logical  threats  pose  an  increasing  risk  to 
mission  critical  business  processes,  BCS  offerings  typically  include 
proactive  elements,  which  seek  to  prevent  the  occurrence  of  logical 
disasters. 

INPUT  research  reveals  that  today's  U.S.  businesses  do  not  perceive 
physical  threats  such  as  floods  and  fires  to  be  the  main  threats  to  the 
continuity  of  their  business  activities.  Logical  threats  such  as  data 
security  and  hardware  and  software  failure  are  now  perceived  to  be  the 
major  threats  to  business  activities. 

The  BCS  market  is  worth  $1.4  billion  in  the  United  States  and  will  be 
worth  $3.2  million  by  2002,  growing  at  18%  CAGR. 

This  study  will: 

•  Help  vendors  to  understand  the  dynamics  affecting  the  BCS 
market 

•  Reveal  ways  in  which  vendors  can  enjoy  continued  success  in  the 
BCS  market 

•  Equip  BCS  vendors  with  information  relating  to  user  attitudes 
towards  business  continuity  services 

•  Reveal  how  BCS  users  perceive  BCS  vendors. 
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B  

Definitions 

INPUT  defines  business  continuity  services  as  services  which  are 
designed  to  protect  business  critical  activities  underpinned  by  IT  from 
interruptions  caused  by  unexpected  incidents  either  by  providing  the 
necessary  facilities  to  continue  those  activities  in  the  event  of  a  major 
incident  or  by  preventing  the  disruption  of  mission  critical  activities  in 
the  first  place.  BCS  can  be  split  into  two  types:  disaster  recovery  (DR) 
services  and  proactive  business  continuity  services. 

DR  services  include  a  number  of  services  elements  that  keep  a  business 
running  in  the  event  of  a  major  incident  which  temporarily  puts  its 
operations  completely  out  of  action.  Service  types  include  backup 
services,  restart  services  and  the  provision  of  standby  sites. 

Proactive  business  continuity  services  are  those  which  seek  to  prevent 
disruptive  incidents  from  taking  place  or  enable  users  to  deal  with  the 
consequences  of  disruptive  incidents  more  effectively.  Tjq^ical  service 
types  include  remote  management  services  and  contingency  planning. 

INPUT  defines  standby  sites  as  follows: 

Exhibit  1-1 

Standby  Site  Definitions 


•  A  cold  standby  site  is  an  alternative  site,  minus  computer  hardware  or  office 
facilities,  available  for  long  term  use 

•  A  warm  standby  site  is  an  alternative  recovery  center  already  equipped  and  ready 
to  begin  the  process  of  resuming  critical  operations  following  a  disaster 

•  A  hot  standby  site  cuts  recovery  time  to  an  absolute  minimum  by  already  having 
current  data  available,  instead  of  having  to  restore  from  backup  media.  The 
ultimate  manifestation  would  be  a  complete  dedicated  standby  system. 

Source:  INPUT/Comdisco 
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c  

Research  Methodology 

INPUT  interviewed  91  users  of  business  continuity  services  and  47 
prospective  users  in  the  United  States.  The  interviews  took  place  in 
July/August  1997. 

Exhibit  1-2  shows  the  distribution  of  the  BCS  customer  sample  by  vertical 
sector. 


Exhibit  1-2 

BCS  Customer  Sample  Split  By  Industry 
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Sample:  91  BCS  Users 
Source:  INPUT 


Exhibit  1-3  shows  the  prospective  BCS  customer  sample  by  industry. 
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Exhibit  1-3 


Prospective  BCS  Customer  Sample  Split  By  Industry 
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Sample:  47  Prospective  BCS  Users 
Source:  INPUT 
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Report  Structure 

The  remaining  chapters  of  this  report  are  as  follows: 

•  Chapter  II  is  an  executive  summary  which  provides  a  summary  of 
the  key  findings  of  the  study 

•  Chapter  III  examines  the  BCS  market.  It  analyzes  the  market  by 
service  types  and  platform  and  offers  commentary  on  future 
opportunities 

•  Chapter  IV  analyzes  the  BCS  industry  and  analyzes  user 
perceptions  of  BCS  vendors 

•  Chapter  V  analyzes  buyer  behavior  in  terms  of  selection  criteria 
when  seeking  BCS,  perceived  benefits  of  BCS,  satisfaction  with 
BCS  and  ways  in  which  BCS  could  be  improved 

•  Appendix  A  illustrates  user  perceptions  of  BCS  vendors  in  more 
detail 

•  Appendix  B  contains  the  BCS  user  questionnaire  used  for  this 
study 

•  Appendix  C  contains  the  BCS  non-user  questionnaire  used  for  this 
study. 

E  

Related  INPUT  Reports 

Other  INPUT  reports  which  address  topics  related  to  the  subjects 
discussed  here  include  the  following: 

IT  Customer  Services  and  Support  Market  Analysis  1997-2002 

Desktop  Services  Opportunities  in  the  United  States,  1997 

U.S.  Call  Center  Operations,  Requirements  and  Opportunities,  1997 
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Executive  Summary 


This  chapter  summarizes  the  findings  of  INPUT'S  U.S.  Business 
Continuity  project.  Additionally,  it  offers  recommendations  to  business 
continuity  services  vendors  on  ways  in  which  they  might  enhance  their 
services. 

A  

Logical  Threats  Outweigh  Physical  Threats  As  Reasons  For  Purchasing 
Business  Continuity  Services 

Business  continuity  services  (BCS)  encompass  more  than  just  disaster 
recovery  (DR)  services.  As  logical  threats  pose  an  increasing  risk  to 
mission  critical  business  processes,  BCS  offerings  typically  include 
proactive  elements  which  seek  to  prevent  the  occurrence  of  logical 
disasters. 

INPUT  research  reveals  that  today's  businesses  do  not  perceive  physical 
threats  such  as  terrorist  bombs,  floods  and  fires  to  be  the  main  threats  to 
the  continuity  of  their  business  activities.  Logical  threats  such  as  data 
security  and  hardware  and  software  failure  are  now  perceived  to  be  the 
major  threats  to  business  activities. 

INPUT  asked  IT  managers  to  indicate  the  importance  of  a  number  of 
reasons  for  purchasing  BCS  contracts  on  a  scale  of  1-5  (l=very  low 
importance,  5=very  high  importance).  Exhibit  II- 1  reveals  the  three  major 
reasons  why  customers  purchase  business  continuity  services  in  the 
United  States. 
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Exhibit  11-1 


Major  Reasons  For  Purchasing  BCS  Contracts 


Virus  Protection 


Data  Security 


Insurance  Requirement 
/  Insurance  Cost  Saving 


1 

Low 


3.8 
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3.8 


Importance 


High 

Sample:  91  BCS  Customers 

Source:  INPUT 


Virus  protection,  data  security  and  the  insurance  implications  of 
purchasing  a  BCS  contract  are  the  major  reasons  for  purchasing  BCS 
contracts  in  the  United  States.  The  first  physical  threat  to  business 
continuity  is  the  ninth  most  important  reason  for  purchasing  BCS  (risk  of 
fire/floods  with  an  importance  rating  of  3. .2). 

Against  this  background  INPUT  research  reveals  that: 

•  The  provision  of  multiplatform  BCS  contracts  is  key  to  sustained 
success  in  the  BCS  market 

•  Proactive  and  predictive  planning,  consultancy  and  management 
services  are  increasingly  being  included  within  BCS  contracts 

•  The  BCS  market  will  be  worth  $3.2  billion  in  2002. 


8 


©  1997  by  INPUT.  Reproduction  Prohibited. 


SC27U 


EVALUATION  OF  BUSINESS  CONTINUITY  SERVICES  IN  THE  U.S.  1997 


INPUT 


B  

Multiplatform  BCS  Contracts  Are  Key 


Enterprise  IT  environments  are  changing.  There  is  a  move  away  from 
mainframe/datacentre  environments  towards  distributed  computing 
environments. 

Exhibit  II-2  illustrates  the  proportion  of  BCS  expenditure  that  can  be 
attributed  to  each  IT  platform. 


Exhibit  11-2 


BCS  Market  Split  By  Platform  Now  And  In  Two  Years'  Time 
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Source:  INPUT 


An  increasing  proportion  of  mission  critical  business  processes  are 
underpinned  by  distributed  IT.  This  is  highlighted  by  the  move  towards 
purchasing  BCS  contracts  that  cover  LAN/WAN  networking  equipment. 
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In  2  years'  time,  an  even  larger  proportion  of  BCS  expenditure  (20%  as 
opposed  to  10%)  will  be  attributable  to  networking  equipment. 

Mainframes  will  still  account  for  the  largest  proportion  of  BCS 
expenditure.  However,  the  proportion  of  BCS  expenditure  that  is 
attributable  to  mainframes  will  fall  from  45%  to  35%  over  the  next  two 
years  as  enterprises  rely  more  heavily  on  distributed  technology'  to 
support  their  business  activities.  At  present,  approximately  50%  of 
customers  purchase  BCS  contracts  for  single  platforms,  mainly 
mainframe  platforms:  however  this  can  be  expected  to  fall  to  around  30% 
as  mission  critical  activities  are  underpinned  by  more  than  one  type  of 
equipment  within  individual  enterprises.  Vendors  must  therefore  offer 
multiplatform  capabilities. 

WTien  asked  to  indicate  the  importance  of  several  vendor  selection 
criteria,  where  1  =  very  low  and  5  =  very  high,  multiplatform  capability 
was  considered  by  most  customers  to  be  very  important. 

Indeed,  approximately  60%  of  BCS  customers  consider  multiplatform 
capabihty  to  be  an  important  selection  criterion  when  choosing  a  BCS 
suppher.  Multiplatform  capability  is  one  of  the  five  most  important 
vendor  selection  criteria  (see  Exhibit  II-3). 
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Exhibit  11-3 


Important  BCS  Vendor  Selection  Criteria 
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Sample:  91  BCS  Customers 
Source:  INPUT 


Over  three  quarters  of  BCS  customers  consider  a  general  support 
capability  to  be  an  important  selection  criterion.  Support  services  are 
becoming  increasingly  important  in  today's  complex  multiplatform, 
multivendor  environments. 

The  ability  to  offer  flexibility  by  tailoring  offerings  to  specific  customer 
requirements,  keeping  costs  low  and  being  perceived  to  offer  'best  of 
breed'  services  are  also  very  important  selection  criteria. 

The  use  of  distributed  IT  environments  for  the  execution  of  mission 
critical  business  processes  will  increase  the  risks  posed  by  logical  threats 
such  as  virus  attacks  and  software  failure.  The  less  complex  nature  of 
mainframe/datacentre  environments  makes  them  less  vulnerable  to 
logical  threats  and  more  exposed  to  physical  threats.  Indeed,  with 
mainframe/datacentre  environments,  mission  critical  data  is  more  likely 
to  be  stored  in  one  physical  environment,  thus  in  the  event  of  a  physical 
disaster  such  as  a  fire,  all  the  data  will  be  lost. 
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Planning  And  Management  Services  Become  Prominent 

As  business  environments  evolve,  so  too  must  business  continuity 
services.  Increasingly,  BCS  vendors  are  augmenting  traditional  disaster 
recovery  services,  which  were  originally  designed  for  mainframe 
environments,  with  proactive  and  predictive  services  that  are  invoked 
throughout  the  lifecycle  of  the  business  environment. 

Proactive  and  predictive  business  continuity  services,  typically  marketed 
as  planning,  consultancy  and  management  services,  account  for  25%  of 
the  U.S.  business  continuity  market.  Exhibit  11-4  shows  that  proactive 
and  predictive  BCS  provisions  will  account  for  40%  of  the  BCS  market  in 
two  years'  time. 


Exhibit  11-4 

BCS  Market  Split  By  Service  Type  Now  And  In  Two  Years'  Time 
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converging.  Users  seek  availability  guarantees  which  cover  interruptions 
to  business  processes  that  are  caused  by  unexpected  incidents.  Such 
guarantees  can  only  be  made  if  services  providers  work  closely  with  their 
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customers  throughout  the  business  lifecycle.  In  order  to  guarantee  high 
availabihty,  business  continuity  services  vendors  must  be  involved  in: 

•  Assessing  the  costs  of  interruptions  to  businesses  and  identifying 
levels  of  availability  that  meet  business  objectives 

•  Planning,  designing  and  implementing  enterprise  environments  to 
support  availability  requirements.  For  example,  network 
architectures  might  be  examined  to  ensure  that  there  is  adequate 
bandwidth  for  expected  transaction  loads.  If  there  is  not  adequate 
bandw^idth,  networks  will  be  re-structured  or  new  ones  will  be 
installed 

•  Remote  management  which  proactively  and  predictively  minimizes 
downtime.  A  proactive  service  might  monitor  IT  environments  and 
anticipate  technological  problems  enabhng  vendors  to  prevent 
problems  from  occurring.  A  predictive  service  might  use  trend 
analysis  to  understand  the  business  demands  placed  on  an  IT 
environment.  Vendors  can  then,  for  example,  anticipate  when 
transaction  loads  will  be  at  their  highest  and  take  action  to  ensure 
that  such  loads  do  not  compromise  availabiht}^ 

Of  course  business  continuity  vendors  must  also  offer  traditional  business 
continuity  services  such  as  standby  sites  in  order  to  minimize  the  adverse 
consequences  of  a  disruptive  incident  but  the  above  services  will  reduce 
the  probabihty  of  such  incidents  interrupting  business  processes  in  the 
first  place. 


BCS  Market  Is  Set  To  Reach  $3.2  Billion 

Fifteen  per  cent  of  U.S.  enterprises  (with  revenues  in  excess  of  $50 
miUion)  have  purchased  currently  running  BCS  contracts  from  external 
vendors.  Of  the  85%  of  enterprises  which  have  not  purchased  BCS 
contracts,  90%  underpin  mission  critical  business  processes  with  IT. 

The  actual  BCS  market  in  terms  of  the  amount  spent  by  users  on  BCS 
contracts  in  1997  is  estimated  to  be  worth  approximately  $1.4  billion. 
However,  this  is  expected  to  grow  to  $3.2  milhon  in  2002  at  18%  CAGE 
(see  Exhibit  II-5). 
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Exhibit  11-5 

U.S.  BCS  Market,  1997-2002 
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Source:  INPUT 


In  order  to  enjoy  growth  in  this  market,  vendors  must  demonstrate  the 
value  of  external  BCS  contracts.  At  present,  the  majority  of  prospective 
users  believe  that  their  internal  BCS  contracts  are  sufficient.  INPUT 
asked  prospective  BCS  users  to  indicate  why  they  have  not  purchased 
BCS  contracts.  Exhibit  II-6  shows  that  internal  BCS  provision  is  the 
main  reason. 
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Exhibit  11-6 


Reasons  For  Not  Purchasing  BCS  Contracts 
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Sample:  47  Prospective  BCS  Customers 

Source:  INPUT 


Vendors  must  convince  prospective  customers  that  the  BCS  cost/benefit 
ratio  merits  expenditure  on  external  BCS  contracts  as  opposed  to  using 
purely  in-house  resources.  Of  those  enterprises  which  do  not  purchase 
BCS  contracts  from  an  external  vendor,  approximately  90%  have  their 
own  in-house  provisions.  This  usually  amounts  to  on-site  backup 
procedures  which  are  typically  carried  out  daily,  although  15%  of  U.S. 
enterprises  have  their  own  standby  sites  (see  Exhibit  11-7). 
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Exhibit  11-7 

Business  Continuity  Provisions  Of  Prospective  BCS  Customers 
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Sample:  47  Prospective  BCS  Customers 

Source:  INPUT 

On-site  backup  procedures  may  well  be  sufficient  to  protect  enterprises 
against  data  loss  in  the  event  of  a  logical  disaster.  However,  they  do  not 
guarantee  the  continuity  of  business  processes.  Additionally,  on-site 
backup  procedures  are  woefully  inadequate  in  the  event  of  a  physical 
disaster. 

Vendors  must  ensure  that  the  market  is  aware  of  the  potential  costs  of 
downtime.  Given  that  approximately  60%  of  prospective  users  stated  that 
the  maximum  acceptable  downtime  for  mission  critical  business 
processes  is  under  12  hours,  it  is  unHkely  that  in-house  provisions  can 
guarantee  to  continue  business  processes  within  12  hours  in  the  event  of 
an  interruption. 

Exhibit  11-8  shows  the  maximum  downtimes  that  are  acceptable  to 
prospective  BCS  customers  in  the  United  States. 


16 


©  1997  by  INPUT  Reproduction  Prohibited. 


SC27U 


EVALUATION  OF  BUSINESS  CONTINUITY  SERVICES  IN  THE  U.S.  1997 


INPUT 


Exhibit  11-8 


Maximum  Acceptable  Downtimes  For  Prospective  BCS  Users 
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BCS  prospects  are  more  likely  to  purchase  BCS  contracts  in  the  future 

as: 

•  Mission  critical  activities  that  were  once  underpinned  by 
mainframes  are  carried  out  in  distributed  IT  environments  which 
are  more  vulnerable  to  increasingly  common  logical  threats 

•  An  increasing  proportion  of  mission  critical  business  activities 
become  underpinned  by  IT 

•  The  Internet  is  used  increasingly  for  mission  critical  activities, 
increasing  threats  to  data  security  and  exposure  to  viruses 

•  Cost/benefit  ratios  for  external  BCS  contracts  are  demonstrated 

•  It  becomes  clear  that  in-house  BCS  provisions  are  often  insufficient 
to  meet  availability  requirements. 
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INPUT  estimates  that  the  average  annual  cost  of  a  BCS  contract  is  in  the 
region  of  S60.000  in  the  United  States.  However,  this  figure  must  not  be 
taken  at  face  value  as  the  variation  in  costs  is  great.  Indeed,  as  might  be 
expected,  the  amount  spent  on  BCS  is  a  function  of  the  size  of  an 
organization  and  its  dependence  on  IT.  Note  that  there  is  httle  variation 
across  vertical  industries. 
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Market  Development 


This  chapter  examines  the  business  continuity  services  (BCS)  market.  It 
analyses  the  market  by  service  types  and  platform  and  offers 
commentary  on  future  opportunities. 


BCS  Market  Growth 


The  BCS  market  can  be  expected  to  grow  from  $1.4  billion  in  1997  to  $3.2 
billion  in  2002  at  18%  CAGE  (see  Exhibit  III-l). 


Exhibit  III-1 


U.S.  BCS  Market,  1997-2002 


Source:  INPUT 
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BCS  market  growth  will  be  driven  by: 

•  The  increasing  proportion  of  mission  critical  business  activities 
that  are  underpinned  by  IT 

•  The  growing  vulnerability  of  businesses  to  logical  threats  such  as 
viruses  as  a  result  of  today's  increasingly  distributed  IT 
environments 

•  BCS  is  not  perceived  to  be  a  core  activity 

•  The  increasing  importance  of  data  security 

•  The  threat  posed  by  the  Y2K  date  change. 

INPUT  research  indicates  that  approximately  15%  of  enterprises  with 
global  revenues  in  excess  of  $50  million  protect  their  businesses  with  a 
BCS  contract  in  the  United  States.  BCS  specialists  are  increasingly 
offering  consultancy,  planning  and  management  services  to  existing 
customers  in  order  to  increase  their  revenues.  Systems  vendors  are 
extending  the  scope  of  their  consultancy,  planning  and  management 
services  and  including  such  services  in  a  package  that  typically  includes 
more  traditional  BCS  services  such  as  standby  services. 

Importantly,  many  enterprises  which  do  not  have  BCS  contracts 
purchase  other  kinds  of  customer  services,  some  of  which  include 
elements  of  BCS.  For  example,  many  network  services  contracts  include 
proactive  network  management  services  that  are  designed  to  minimise 
downtime.  Maintenance  contracts  and  warranties  will  also  overlap  with 
BCS  contracts  in  the  event  of  most  logical  disasters. 

The  growth  in  the  BCS  market  will  be  fuelled  largely  by  new  customers 
as  opposed  to  offering  existing  customers  additional  services.  However, 
BCS  is  still  often  viewed  as  reactive  disaster  recovery.  Vendors  must 
encourage  enterprises  to  view  BCS  as  an  integrated  service  offering  that 
offers  a  full  range  of  proactive,  predictive  and  reactive  services  that  are 
used  throughout  the  lifecycle  of  a  business  environment.  In  other  words, 
BCS  services  should  be  marketed  prior  to  implementation  and  should  not 
just  be  invoked  in  the  event  of  a  disaster  but  used  continuously  to 
minimise  the  impact  of  any  disaster  and  to  prevent  disasters  where 
remotely  possible. 
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Exhibit  III-2 


As  an  increasing  proportion  of  mission  critical  activities  are  carried  out  in 
distributed  IT  environments,  so  logical  threats  increase.  Indeed,  INPUT 
research  reveals  that  the  five  major  perceived  threats  to  prospective  BCS 
users  and  to  existing  BCS  customers  are  logical. 

Exhibit  III-2  reveals  which  factors  prospective  BCS  users  believe  pose  a 
significant  threat  to  the  continuity  of  their  businesses. 


Threats  To  Businesses  Of  Prospective  BCS  Users 
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Sample:  47  Prospective  BCS  Customers 

Source:  INPUT 


INPUT  asked  customers  to  indicate  the  most  important  reasons  for 
purchasing  BCS  contracts  on  a  scale  of  1  to  5  (where  l=not  at  all 
important  and  5  =  very  important).  Exhibit  III-3  illustrates  the  ten  most 
important  reasons  for  purchasing  BCS  contracts. 
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Exhibit  III-3 


Reasons  For  Purchasing  BCS 
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Interestingly,  BCS  customers  perceive  the  data  security  and  the  failure  of 
internal  backups  to  be  the  two  most  important  reasons  for  purchasing 
BCS  contracts. 

Exhibits  III-4  to  III-6  illustrate  the  most  important  reasons  for 
purchasing  BCS  contracts  within  major  industries. 
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Exhibit  III-4 


Reasons  For  Purchasing  BCS  In  Banking  &  Finance 
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Exhibit  III-5 


Reasons  For  Purchasing  BCS  In  Distribution 
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Exhibit  III-6 


Reasons  For  Purchasing  BCS  In  Manufacturing 
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When  the  most  important  reasons  for  purchasing  BCS  contracts  are 
analysed  by  industry,  logical  threats  are  generally  considered  to  be  more 
important  than  physical  threats.  However,  some  industries  have  their 
own  distinct  characteristics.  For  example,  in  the  distribution  industry, 
the  risk  of  fire/flood  is  one  of  the  two  most  important  drivers. 
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Market  Growth  Split  By  Service  Type 

Of  the  BCS  market,  55%  of  the  market  can  be  attributed  to  standby  sites, 
20%  to  backup  services  and  25%  to  planning,  consultancy  and 
management  services  (see  Exhibit  III-7). 


Exhibit  III-7 

BCS  Market  Split  By  Service  Type 
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Source:  INPUT 


Currently,  planning,  consultancy  and  management  services  account  for  a 
relatively  small  25%  of  BCS  contracts  in  terms  of  value.  The  market  for 
planning,  consultancy  and  management  services  for  business  continuity 
is  actually  much  larger  than  the  $350  milhon  associated  with  BCS 
contracts.  Much  consultancy  is  sold  as  part  of  other  types  of  contracts. 
For  example,  many  management  consultancies  offer  contingency 
planning  services.  Systems  vendors  offer  planning  services  designed  to 
maximise  availability,  and  remote  management  services  designed  to 
proactively  minimise  downtime.  The  market  for  these  types  of  services  is 
becoming  increasingly  fragmented  as  vendors  from  many  different 
backgrounds  attempt  to  fully  exploit  BCS  opportunities. 
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INPUT  believes  that  the  greatest  opportunities  in  the  BCS  market  He 
and  will  continue  to  lie  in  the  provision  of  proactive  planning,  consultancy 
and  management  services.  Traditionally  business  continuity  services 
were  essentially  reactive  services  —  when  a  problem  occurs  business 
continuity  plans  were  invoked.  However,  although  customers  do  require 
such  services,  many  require  an  integrated  service  offering,  which  will 
guarantee  business  continuity  to  a  certain  degree.  Such  guarantees  can 
be  honoured  not  only  by  invoking  traditional  reactive  BCS  plans  but  also 
by  using  proactive  BCS  services  such  as: 

•  Assessment  services  -  such  services  assess  the  cost  of  interruptions 
to  a  business  and  identify  levels  of  availability  that  meet  business 
objectives 

•  Planning  and  design  services  -  such  services  design  enterprise 
environments  to  support  availability  requirements.  For  example 
network  architectures  might  be  examined  to  ensure  that  there  is 
adequate  bandwidth  for  expected  transaction  loads.  If  there  is  not 
adequate  bandwidth,  the  network  will  be  re-designed 

•  Remote  management  services  -  such  services  are  designed  to 
proactively  and  predictively  minimise  downtime.  A  proactive  BCS 
might  monitor  IT  environments  and  anticipate  technological 
problems  enabling  vendors  to  prevent  problems  from  occurring.  A 
predictive  BCS  might  use  trend  analysis  to  understand  the 
business  demands  placed  on  an  IT  environment.  Vendors  can  then, 
for  example,  anticipate  when  transaction  loads  will  be  at  their 
highest  and  take  action  to  ensure  that  such  loads  do  not 
compromise  availability. 

It  must  also  be  noted  that  many  businesses  undertake  their  own  risk 
analyses  and  planning.  Typically,  they  purchase  some  consultancy 
services  from  a  BCS  vendor  with  a  BCS  contract  but  do  use  an  external 
vendor  to  help  revise  their  plans  thereafter. 

BCS  vendors  are  becoming  increasingly  aware  of  the  importance  of 
consultancy-style  services  and  include  them  in  BCS  contracts  wherever 
possible.  Equally,  users  are  becoming  increasingly  aware  of  the 
importance  of  consultancy-style  services  as  an  increasing  proportion  of 
business  processes  are  undertaken  using  IT.  For  these  reasons,  planning, 
design  and  consultancy  will  account  for  40%  of  the  BCS  market  in  2 
years'  time  (see  Exhibit  III-8). 
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Exhibit  lli-8 

BCS  Market  Split  By  Service  Type  In  Two  Years'  Time 
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Source:  INPUT 


c  

BCS  Market  Split  By  Platform 

Approximately  45%  of  the  BCS  market  can  be  attributed  to  mainframe 
platforms.  Around  12%  can  be  attributed  to  proprietary  midrange  servers 
such  as  AS/400s  Unix  servers  and  NT  servers  respectively.  Ten  per  cent 
of  the  market  can  be  attributed  to  networking  equipment  for  LANs  and 
WANs  while  standalone  telephony  and  PCs  account  for  5%  and  4% 
respectively.  Exhibit  1II-9  splits  the  BCS  market  by  platform. 
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Exhibit  III-9 

BCS  Market  Split  By  Platform 
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As  distributed  IT  environments  become  commonplace,  demands  for  BCS 
increasingly  reflect  these  changes.  Although  mainframes  will  still  account 
for  most  BCS  spending  in  the  United  States,  BCS  vendors  who  wish  to 
see  their  businesses  grow  must  focus  to  a  greater  extent  on  networking 
technology,  Unix  servers  and  NT  servers  and  to  a  lesser  extent  on 
mainframe/datacentre  environments  and  proprietary  midrange  platforms 
(see  Exhibit  III-IO). 
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Exhibit  111-10 


BCS  Market  Split  By  Platform  In  Two  Years'  Time 
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Downtimes  And  Response  Times 


Standby  times  vary  greatly.  However,  as  more  mission  critical  business 
processes  are  undertaken  using  IT,  vendors  are  responding  to  customer 
requirements  by  lowering  standby  times. 

Customers  were  asked  to  indicate  the  maximum  amount  of  time  for 
which  they  could  accept  interruption  to  their  most  critical  business 
processes.  Exhibit  111-11  reveals  that  nearly  60%  could  not  accept 
downtime  of  more  than  12  hours. 
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Exhibit  111-11 


Maximum  Downtime  Acceptance 
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Sample:  91  BCS  Customers 
Source:  INPUT 


This  pattern  is  fairly  similar  across  all  vertical  sectors  which  indicates 
that  BCS  vendors  must  offer  contracts  that  can  guarantee  recovery 
within  12  hours  in  order  to  enjoy  success  in  this  market. 

Typically,  BCS  vendors  offer  three  types  of  standby  sites: 

•  Hot  standby  sites  which  cut  recovery  time  to  an  absolute  minimum 
by  already  having  current  data  available,  instead  of  having  to 
restore  from  backup  media.  The  ultimate  manifestation  would  be  a 
complete  dedicated  standby  system 

•  Warm  standby  sites  which  are  alternative  recovery  centres  already 
equipped  and  ready  to  begin  the  process  of  resuming  critical 
operations  following  a  disaster 

•  Cold  standby  sites  are  alternative  sites,  minus  computer  hardware 
or  office  facihties,  available  for  long  term  use. 
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INPUT  asked  users  to  indicate  the  amount  of  time  that  it  takes  for  their 
standby  sites  to  become  available. 

Exhibit  III- 12  illustrates  average  response  times  for  hot  standby,  warm 
standby  and  cold  standby  in  the  United  States. 


Exhibit  111-12 


Average  Response  Times  For  Standby  Sites 
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Sample:  91  BCS  Customers 
Source:  INPUT 


All  standby  times  will  fall  over  the  next  few  years  as  a  result  of  customer 
pressure  and  increased  competition  in  the  rapidly  growing  BCS  market. 


BCS  Market  Inhibitors 


INPUT  asked  prospective  users  to  indicate  why  they  didn't  purchase  BCS 
contracts.  Exhibit  111-13  reveals  that  sufficient  internal  provision  was  the 
greatest  disincentive  to  buying  BCS  contracts. 
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Exhibit  111-13 


Reasons  For  Not  Purchasing  BCS  Contracts 
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Nearly  50%  of  U.S.  enterprises  believe  that  they  have  sufficient  provision 
for  the  continuity  of  their  businesses.  For  this  reason,  many  enterprises 
do  not  believe  that  it  is  necessary  for  them  to  purchase  BCS  contracts 
from  an  external  vendor.  However,  many  enterprises  are  not  fully  aware 
of  the  consequences  of  an  interruption  to  their  businesses  and  in  fact  do 
not  have  adequate  protection  against  interruptions. 

Furthermore,  many  businesses  perceive  physical  threats  as  something  to 
be  dealt  with  by  insurance  and  logical  threats  as  the  responsibility  of  IT 
vendors.  Many  do  not  realise  that  insurance  will  only  cover  expenses 
caused  by  downtime  and  will  not  protect  against  lost  business. 

The  average  cost  of  a  BCS  contract  in  the  United  States  is  approximately 
$60,000  annually.  However,  there  is  wide  variation  in  BCS  costs.  Some 
businesses  spend  less  than  $5,000  on  BCS  while  others  spend  millions. 
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Industry  And  Competition 


This  chapter  analyses  the  BCS  industry  and  analyses  user  perceptions  of 
BCS  vendors. 

A   ^  

BCS  Players 

Until  recently,  business  continuity  services  were  essentially  reactive 
services.  Several  specialist  disaster  recovery  vendors  emerged  such  as 
Comdisco  and  Sungard.  These  vendors  typically  focused  on  offering  the 
physical  environment  that  was  necessary  to  enable  business  processes  to 
continue  in  the  event  of  a  disruptive  incident.  Additionally,  they  tended 
to  offer  recovery  expertise  in  specific  types  of  proprietary  hardware  and 
software. 

Most  major  systems  vendors  such  as  IBM,  H-P  and  Digital  offered 
business  continuity  services  centered  around  their  own  equipment  and 
enjoyed  success  in  the  market.  Some  professional  service  vendors  also 
entered  the  fray  attempting  to  leverage  their  consultancy  expertise. 

However,  as  IT  underpins  an  increasing  proportion  of  mission  critical 
business  processes,  enterprises  seek  a  more  proactive  approach  to 
ensuring  business  continuity.  Technology  is  now  available  to  enable 
vendors  to  prevent  many  logical  disasters  from  occurring  in  the  first 
place.  Users  increasingly  seek  BCS  contracts  that  incorporate  traditional 
reactive  business  continuity  services  (disaster  recovery  services)  with 
proactive  services  that  are  designed  to  maximize  availability. 

Many  BCS  vendors  now  offer  services  throughout  the  lifecycle  of  business 
environments.  Such  services  are  designed  to: 

•  Minimize  the  risk  of  disruptive  incidents  through  effective 
planning 
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•  Ensure  that  business  environments  are  implemented  in  a  manner 
that  minimizes  the  risk  of  disruptive  incidents 

•  Anticipate  disruptive  incidents  proactively  and  predictively,  and 
prevent  them  from  occurring  where  possible 

•  Use  standby  recovery  facilities  if  all  else  fails. 

Such  services  minimize  the  risk  of  needing  to  invoke  recovery  plans. 
Many  vendors,  especially  systems  vendors  such  as  Digital,  H-P  and  NCR 
strongly  focus  on  what  can  be  termed  as  the  proactive  aspects  of  BCS. 


Market  Positioning 

INPUT  asked  users  of  BCS  to  indicate  whether  or  not  they  are  aware  of 
major  BCS  vendors  in  the  United  States.  Additionally,  BCS  customers 
were  asked  to  indicate  their  perceptions  of  the  business  continuity 
capabilities  of  BCS  vendors  of  whom  they  are  aware  on  a  scale  of  1  to  5 
(where  1  =  low  capability  and  5  =  high  capability).  A  score  of  3  is  taken  to 
represent  medium  capability;  awareness  of  a  vendor's  BCS  activities  by 
40%  of  BCS  customers  represents  medium  awareness. 

Exhibit  IV- 1  illustrates  user  perceptions  of  major  BCS  vendors. 
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Exhibit  IV-1 

BCS  Customers'  Perceptions  Of  BCS  Vendors 
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Customers  have  at  least  reasonably  high  regard  for  the  capabilities  of 
most  of  the  BCS  vendors  of  whom  they  are  aware.  The  largest  systems 
vendors  in  the  U.S.,  IBM,  H-P,  and  Digital  are  well  placed;  they  have 
high  market  visibility  and  BCS  customers  perceive  them  to  be  highly 
capable  BCS  vendors.  BCS  specialist  Comdisco,  is  also  perceived  to  be 
highly  capable  and  has  high  market  visibility. 

INPUT  also  asked  prospective  users  of  BCS  to  indicate  their  perceptions 
of  the  business  continuity  capabilities  of  BCS  vendors  of  whom  they  are 
aware  on  a  scale  of  1  to  5  (where  l=low  capability  and  5=high  capability). 
A  score  of  3  is  taken  to  represent  medium  capability. 

Exhibit  IV-2  illustrates  prospective  users'  perceptions  of  major  BCS 
vendors. 
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Exhibit  IV-2 

Prospective  BCS  Customers'  Perceptions  Of  BCS  Vendors 
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Source:  INPUT 


Prospective  BCS  customers  in  the  United  States  have  particularly  high 
regard  for  the  BCS-related  capabilities  of  IBM  and  H-P. 


Customer  Satisfaction  With  Major  BCS  Vendors 

INPUT  asked  BCS  customers  to  indicate  their  levels  of  satisfaction  with 
their  BCS  vendor(s)  (where  l=very  low  satisfaction  and  5=very  high 
satisfaction). 

Exhibit  IV-3  shows  customer  satisfaction  levels  with  major  BCS  vendors. 


38 


©  1997  by  INPUT  Reproduction  Prohibited. 


SC27U 


EVALUATION  OF  BUSINESS  CONTINUITY  SERVICES  IN  THE  U.S.  1997 


INPUT 


Exhibit  IV-3 


Customer  Satisfaction  Levels  With  Major  BCS  Vendors 
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The  sample  sizes  are  as  follows: 


20  IBM  customers 


•  20  Sungard  customers 


19  Comdisco  customers 


Customer  satisfaction  levels  with  all  BCS  vendors  are  very  high. 
However  a  sample  of  5  or  more  only  existed  for  IBM,  Sungard  and 
Comdisco.  Any  score  above  3.8  is  considered  by  INPUT  to  be  a  good  score. 


Important  Vendor  Attributes 


INPUT  asked  BCS  customers  to  indicate  what  they  perceived  to  be  the 
most  important  vendor  attributes. 

Technical  expertise  and  reliability  were  mentioned  most  frequently  by 
BCS  customers  as  important  vendor  attributes  (see  Exhibit  IV-4). 
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Exhibit  IV-4 


Important  Vendor  Attributes 
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Buyer  Behavior 


This  chapter  analyses  buyer  behavior  in  terms  of  selection  criteria  when 
seeking  business  continuity  services  (BCS),  perceived  benefits  of  BCS, 
satisfaction  with  BCS  and  ways  in  which  BCS  could  be  improved. 


BCS  Selection  Criteria 

INPUT  asked  BCS  customers  to  indicate  the  importance  of  a  number  of 
selection  criteria  when  choosing  a  BCS  vendor.  Exhibit  V-1  illustrates  the 
most  important  selection  criteria  to  BCS  customers. 
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Exhibit  V-1 


Major  BCS  Selection  Criteria 
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The  ability  to  provide  support  to  customers  is  the  most  important 
selection  criterion  for  BCS  customers.  Customers  require  vendors  to  offer 
a  general  support  capability  in  terms  of  both  breadth  and  depth. 

The  ability  to  tailor  BCS  offerings  to  specific  customer  requirements  is  a 
very  important  selection  criterion  for  US  BCS  customers.  As  IT 
environments  become  more  complex,  each  enterprise  typically  has  a 
unique  IT  environment  which  necessitates  a  flexible  approach  to  services 
provision  from  vendors. 

The  cost  of  services,  the  ability  to  offer  'best  of  breed'  services  and 
multiplatform  capability  are  also  important  selection  criteria. 


Additionally,  customers  seek  BCS  which  are  closely  linked  to  their 
business  processes.  In  other  words,  they  want  BCS  contracts  which  can 
ensure  the  continuity  of  their  business  processes.  In  order  to  offer  such 
services,  BCS  vendors  must  have  a  specific  understanding  of  the  business 
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processes  in  question.  Hence,  vendors  must  gain  some  business  process 
expertise  to  complement  their  technical  expertise. 

Exhibits  V-2  to  V-4  reveal  the  five  most  important  selection  criteria  for 
three  major  vertical  industries;  namely  banking  and  finance,  distribution, 
and  manufacturing. 


Exhibit  V-2 

Major  BCS  Selection  Criteria  In  Banking  &  Finance 
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Exhibit  V-3 


Major  BCS  Selection  Criteria  In  Distribution 
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Exhibit  V-4 


Major  BCS  Selection  Criteria  in  Manufacturing 
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INPUT  also  asked  prospective  buyers  of  BCS  services  to  indicate  the 
importance  of  several  vendor  selection  criteria  if  they  were  to  purchase  a 
BCS  contract.  Exhibit  V-8  illustrates  the  importance  of  several  selection 
criteria  to  prospective  BCS  buyers. 


Exhibit  V-5 


BCS  Selection  Criteria  For  Prospective  Users 
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Prospective  BCS  customers  and  BCS  customers  perceive  broadly  the 
same  selection  criteria  to  be  the  most  important.  However,  importance 
levels  are  higher  for  prospective  buyers  than  for  existing  customers.  In 
particular  the  cost  of  the  service  is  given  a  very  high  importance  rating  by 
prospective  BCS  customers. 
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B  

Benefits  Of  BCS 


INPUT  asked  BCS  customers  to  indicate  reasons  for  purchasing  BCS 
contracts.  Exhibit  V-6  illustrates  the  reasons  which  were  most  commonly 
mentioned  by  customers  when  they  were  asked  to  indicate  the  three  main 
benefits  of  BCS  . 


Exhibit  V-6 


Major  Benefits  Of  BCS  Services 
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Reliability  emerges  as  the  major  benefit  associated  with  BCS  services  by 
U.S.  businesses.  Access  to  expertise  and  skills  and  peace  of  mind  are 
commonly  mentioned  benefits  of  BCS  services.  The  use  of  BCS  to 
maximize  availability  is  also  mentioned  by  a  significant  number  of  BCS 
customers. 

Exhibit  V-7  illustrates  the  extent  to  which  BCS  customers  believe  that 
benefits  associated  with  BCS  have  been  achieved. 
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Exhibit  V-7 


Extent  To  Which  Benefits  Have  Been  Achieved 
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BCS  customers  believe  that  business  continuity  services  achieve  the 
desired  goal  of  offering  them  access  to  business  continuity  skills  and 
expertise.  Peace  of  mind  and  a  feeling  of  security  are  also  broadly 
achieved  by  BCS. 


Decision  Makers 

INPUT  asked  BCS  customers  to  indicate  the  influence  of  several  decision 
makers  on  the  decision  to  purchase  BCS.  Exhibit  V-8  illustrates  the 
influence  of  key  decision  makers  on  BCS  purchases. 
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Exhibit  V-8 


The  Influence  Of  Key  Decision  Makers  On  BCS  Purchases 


IT  Director 


IT  Manager 


Financial  Director 


External  Auditor 


Internal  Auditor 


Managing  Director 


Business  User 


Low 


4.3 


3.9 


3.4 


3.3 


3.1 


3.0 


2.7 


3 

Influence 


High 

Sample:  91  BCS  Customers 
Source:  INPUT 


Perhaps  surprisingly,  IT  Directors  and  IT  Managers  are  the  chief 
decision  makers  for  BCS  purchases.  Finance  Directors  also  have  a 
significant  amount  of  influence.  Business  users  continue  to  have 
relatively  little  influence  on  BCS  purchasing  decisions.  This  is  likely  to 
change  in  the  near  future.  As  IT  and  business  processes  become 
indistinguishable,  business  users  can  be  expected  to  have  greater 
influence  on  such  purchasing  decisions. 


BCS  Satisfaction 


INPUT  asked  BCS  customers  to  indicate  their  levels  of  satisfaction  with 
ten  BCS  features.  Exhibit  V-9  illustrates  customer  satisfaction  levels 
with  each  feature. 
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Exhibit  V-9 


Customer  Satisfaction  With  BCS  Features 


Access  to  Standby  Sites 


Support 


Flexibility 


Response  Times 


Ability  of  Stanby  Site  to  Enable  BC 


Proactivity 


Multiplatform  Expertise 


Network  Expertise 


Cost  of  Service 


 1 


1 

Low 


4.2 


3.8 


3.6 


3.5 


3.4 


3.4 


3.3 


3.3 


Satisfaction 


 1 

5 

High 

Sample:  91  BCS  Customers 
Source:  INPUT 


Customers  exhibited  high  satisfaction  levels  with  access  to  standby  sites, 
flexibility  and  support..  However,  customers  are  concerned  with  the  cost 
of  BCS  and  the  ability  of  vendors  to  offer  truly  multiplatform  BCS  and 
offer  network  expertise.  Many  BCS  offerings  focus  on  specific  platforms 
and  few  BCS  vendors  can  boast  expertise  across  all  platforms  and 
networks. 

INPUT  asked  BCS  customers  to  indicate  their  levels  of  satisfaction  with 
specific  disaster  recovery  (DR)  service  types. 

DR  services  can  be  defined  as  services  that  keep  a  business  running  in 
the  event  of  a  major  incident  which  temporarily  puts  its  operations 
completely  out  of  action.  Service  types  include  backup  services,  and  the 
provision  of  standby  sites. 

Exhibit  V-10  reveals  that  satisfaction  levels  for  all  DR  service  types  are 
high. 
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Exhibit  V-10 


Customer  Satisfaction  With  DR  Service  Types 


Hot  Standby 


On-Site  Backup  / 
Mobile  Units 


Warm  Standby 


Cold  Standby 


1 

Low 


4.2 


4.0 


3.8 


3.8 


Satisfaction 


5 

High 


Sample:  91  BCS  Customers 
Source:  INPUT 


Additionally,  INPUT  asked  customers  to  indicate  their  satisfaction  levels 
with  proactive  BCS  types. 

Proactive  business  continuity  services  can  be  defined  as  services  which 
seek  to  prevent  disruptive  incidents  from  taking  place  or  enable  users  to 
deal  with  the  consequences  of  disruptive  incidents  more  effectively. 
Typical  service  types  include  remote  management  services  and 
contingency  planning. 


Exhibit  V-11  reveals  that  satisfaction  levels  are  also  high  for  proactive 
BCS. 
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Exhibit  V-11 


Customer  Satisfaction  With  Proactive  BCS  Types 


Remote  Management 


Virus  Protection  /  Data 
Security 


Risk  Analysis  / 
Contingency  Planning 


Low 


3.7 


3.6 


Satisfaction 


— I 
5 

High 


Sample:  91  BCS  Customers 
Source:  INPUT 


input's  research  indicates  that  there  is  considerable  scope  for 
improvement  in  the  provision  of  risk  analysis/contingency  planning 
services.  BCS  suppliers  must  ensure  that  they  have  an  adequate 
understanding  of  customers'  businesses  in  order  to  be  able  to  offer  real 
value  in  risk  analysis  and  contingency  planning  services.. 

INPUT  asked  DR  customers  to  indicate  their  levels  of  satisfaction  with 
DR  services  for  specific  platforms.  Exhibit  V-12  shows  customer 
satisfaction  with  DR  services  different  platforms. 


SC27U 


©  1997  by  INPUT  Reproduction  Prohibited. 


51 


EVALUATION  OF  BUSINESS  CONTINUITY  SERVICES  IN  THE  U.S.  1997 


INPUT 


Exhibit  V-12 


Satisfaction  With  DR  Services  By  Platform 


Mainframes 
NT  Servers 
Proprietary  Midrange 
Unix  Servers 
PC/LANs 
Telephony 
WANs 
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'  3.7 


 1 


36 


Satisfaction 
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Sample:  91  BCS  Customers 
Source:  INPUT 


Distributed  computing  is  becoming  increasingly  important.  For  this 
reason,  the  focus  of  DR  is  shifting  away  from  platform  specific  DR 
provision  to  enterprise  wide  DR  provision. 

Mainframes  and  datacentres  have  until  recently  been  responsible  for  the 
vast  majority  of  mission  critical  IT  activity.  Hence,  for  many  years,  DR 
specialists  have  focused  their  efforts  on  the  recovery  of 
mainframe/datacentre  environments.  As  one  would  expect,  customers 
express  the  highest  levels  of  satisfaction  with  DR  services  for 
mainframe/datacentre  environments. 


Customer  satisfaction  with  DR  services  for  NT,  Unix  and  proprietary 
midrange  platforms  are  also  high.  This  bodes  well  for  DR  vendors  given 
that  an  increasing  amount  of  mission  critical  activity  takes  place  on  NT 
and  Unix  platforms. 

However,  there  is  room  for  improvement  with  BCS  services  for 
increasingly  important  WANs.  Higher  satisfaction  levels  will  become 
necessary  for  WANs  as  enterprises  increasingly  depend  on  WANs  for 
mission  critical  activity. 
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INPUT  asked  proactive  BCS  customers  to  indicate  their  levels  of 
satisfaction  with  proactive  BCS  for  specific  platforms.  Exhibit  V-13  shows 
customer  satisfaction  with  proactive  BCS  on  different  platforms. 


Exhibit  V-13 


Satisfaction  With  Proactive  BCS  By  Platform 


Mainframes 


Unix  Servers 


NT  Servers 


Proprietary  Midrange 


WANs 


PC/LANs 


1 
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3.9 
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3.4 
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Sample:  91  BCS  Customers 
Source:  INPUT 


INPUT  asked  BCS  customers  to  indicate  their  levels  of  satisfaction  with 
the  workspace  with  which  they  will  be  provided  by  vendors  in  the  event 
of  a  disaster.  Exhibit  V-14  reveals  customer  satisfaction  levels  with 
workspace  provision. 
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Exhibit  V-14 


User  Satisfaction  With  Alternative  Workspaces 
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Sample:  91  BCS  Customers 
Source:  INPUT 


Interestingly,  over  15%  of  BCS  customers  expressed  extremely  low  levels 
of  satisfaction  with  their  alternative  workspace.  Customers  expressed 
concern  relating  to  the  size  of  the  workspace  and  its  functionaUty.  Some 
customers  also  beheve  that  the  ratio  of  subscribers  to  workspace  is  too 
high. 

However,  nearly  60%  of  BCS  customers  expressed  high  levels  of 
satisfaction  with  their  alternative  w^orkspaces. 

E  

BCS  Improvements 

INPUT  asked  BCS  customers  to  indicate  the  w^ays  in  w^hich  they  believed 
that  their  BCS  could  be  improved.  Exhibit  V-15  shows  the  most 
commonh'  mentioned  wa^'S  in  which  users  believe  that  BCS  could  be 
improved. 


54 


©  1997  by  INPUT.  Reproduction  Prohibited. 


SC27U 


EVALUATION  OF  BUSINESS  CONTINUITY  SERVICES  IN  THE  U  S  1997 


INPUT 


Exhibit  V-15 

BCS  Improvements 
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Sample:  91  BCS  Customers 

Source:  INPUT 

Lowering  BCS  costs  is  the  main  way  in  which  vendors  could  improve 
their  services  in  the  eyes  of  the  user  community.  A  significant  number  of 
enterprise  users  state  unprompted  that  vendors  could  improve  BCS  by 
adopting  a  more  proactive  approach.  Such  an  approach  might  involve 
anticipating  the  interruption  of  business  processes  and  taking  action  to 
prevent  any  interruption  from  taking  place  unbeknown  to  the  customer. 

When  asked  to  indicate  ways  in  which  alternative  workspaces  could  be 
improved,  accessibility  and  size  were  mentioned  most  frequently. 
Additionally,  a  significant  number  of  users  believe  that  their  alternative 
workspaces  are  do  not  contain  all  the  necessary  equipment  to  meet  their 
needs.  Exhibit  V-16  shows  the  major  ways  in  which  users  believe  that 
their  alternative  workspaces  could  be  improved. 
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Exhibit  V-16 


Alternative  Workspace  Improvements 
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BCS  Customer  Perceptions 


Amdahl 


This  appendix  illustrates  the  perceptions  of  services  vendors  held  by  91 
business  continuity  services  (BCS)  customers  in  the  United  States. 

Customers  were  asked  to  indicate  their  perceptions  of  the  capability  of  a 
number  of  vendors  as  BCS  suppliers  where  1  =  low  capability  and  5  = 
high  capability. 


39  interviewees  are  aware  of  the  BCS  activities  of  Amdahl. 


Exhibit  A-1 
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Comdisco 


68  interviewees  are  aware  of  the  BCS  activities  of  Comdisco. 


Exhibit  A-2 
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Data  General 


Exhibit  A-3 


44  interviewees  are  aware  of  the  BCS  activities  of  Data  General. 
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Digital 


Exhibit  A-4 


56  interviewees  are  aware  of  the  BCS  activities  of  Digital 
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H-P 


70  interviewees  are  aware  of  the  BCS  activities  of  H-P. 


Exhibit  A-5 
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IBM 


73  interviewees  are  aware  of  the  BCS  activities  of  IBM. 


Exhibit  A-6 
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NCR 


28  interviewees  are  aware  of  the  BCS  activities  of  NCR. 


Exhibit  A-7 
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H  

Safety  net 


Exhibit  A-8 


26  interviewees  are  aware  of  the  BCS  activities  of  Safetynet. 
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Unisys 


49  interviewees  are  aware  of  the  BCS  activities  of  Unisys. 


Exhibit  A-9 
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Wang 


39  interviewees  are  aware  of  the  BCS  activities  of  Wang. 


Exhibit  A-10 
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Business  Continuity  Services 
Non  User  Questionnaire,  U.S. 


Definitions 

Business  continuity  services  (BCS)  can  be  described  as  services  that  are 
designed  to  protect  business  critical  activities  underpinned  by  IT  from 
disaster  either  by  providing  the  necessary  facihties  to  continue  those 
activities  in  the  event  of  a  disaster  or  by  preventing  disasters  from 
disrupting  business  critical  activities  in  the  first  place.  BCS  can  be  split 
into  two  types:  disaster  recovery  (DR)  services  and  proactive  business 
continuity  services. 

DR  services  include  a  number  of  services  elements  that  keep  a  business 
running  in  the  event  of  a  major  incident  which  temporarily  puts  its 
operations  completely  out  of  action.  Service  types  include  backup 
services,  restart  services  and  the  provision  of  standby  sites. 

Proactive  business  continuity  services  are  those  which  seek  to  prevent 
disasters  from  taking  place  or  enable  users  to  deal  with  the  consequences 
more  effectively.  Typical  service  types  include  remote  management 
services  and  contingency  planning. 
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Respondent  Details 


Company  Name 

Respondent  Name 

Job  Title 

Total  Annual  Turnover 

Total  Number  of  Staff 

Total  IT  Budget 

Total  Number  of  IT  Staff 

Industry 


Banking  and  Finance 

Insurance 

Government 

Distribution 

Utilities 

Manufacturing 

Other  (please  specify) 

Screening  Questions 

1.        Please  indicate  if  you  have  purchased  any  of  the  following  business 
continuity  provisions  in  the  last  five  years: 


 — -                           -  - 

Disaster  Recovery  Services 

Proactive  Business  Continuity 
Services  (e.g.  remote 
management  ser\T.ces) 

Are  any  of  your  business  activities  that  are  strongly  underpinned 
by  IT  mission  critical? 


Yes 

No 

^                                                                    ,                  ,  ,    ,  ■ 
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3.        If  yes,  which  of  these  processes/appHcations  are  mission  critical? 


If  yes  to  either  option  in  Ql  and  no  to  Q2,  please  terminate  the 
interview  or  switch  to  user  questionnaire. 

4.        Please  indicate  the  extent  to  which  you  think  the  following  factors 
pose  a  threat  to  the  continuity  of  your  mission  critical  IT  activities 
(l=very  low,  5=very  high)  now.  Additionally,  please  indicate  how 
big  a  threat  you  believe  these  factors  will  pose  in  2  years'  time 
(l=very  low,  5=very  high).  Please  rotate. 


I;, 
I 

t  

Now  (1-5)  i  In  2  Years 

Insurance  requirement/Insurance  Cost 
Saving 

Credibility  with  shareholders/customers  | 

-  _  A  

< 

Fire/Flood  Risk 

Threat  of  Terrorism 

Year  2000  Issues 

Risk  of  Power  Cuts/Surges 



Failure  of  internal  backups 

Risk  of  Theft 



Risk  of  software  or  hardware  failure 

Internet  security 

Virus  attack 

Data  security 

Increased  use  of  networks 

Other(s)  (please  specify 

  i 

5.        Please  indicate  why  you  have  chosen  not  to  purchase  business 
continuity  services  from  an  external  vendor 
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6.        What  provisions  has  your  organisation  taken  to  protect  its  mission 
critical  IT  activities  from  the  effect  of  a  disaster? 


7.        How  will  your  IT  infrastructure  change  in  the  next  2  years? 


8.        How  will  this  affect  your  need  for  business  continuity  services? 


9.        Under  what  circumstances  would  you  purchase  business  continuity 
services  from  an  external  vendor? 


10.      What  benefits  would  you  seek  from  use  of  external  business 
continuity  services? 


11.      What  is  the  maximum  downtime  that  you  can  accept? 


0-6  hours 



7-12  hours 

13-24  hours 

25-48  hours 

49-72  hours 

More  than  72  hours 

12.      In  the  next  two  years,  do  you  beheve  that  this  will: 


Increase 
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Decrease 

Stay  the  same 

   V  

13.      Please  indicate  whether  or  not  you  are  aware  of  the  following 

vendors  as  business  continuity  vendors.  If  you  are  aware  of  their 
business  continuity  activities,  please  indicate  your  impression  of 
their  business  continuity  capabilities  (l=low  capability,  5=high 
capability).  Please  rotate 


Aware  (1 /IN)             Capability  (l-o) 

Amdahl 

,  .....  

 1  

1 

-         .4-   -  —  ~ 

Cap  Gemini 

Cap-RS  (now  SG-RS) 

Comdisco 

Data  General 

i 

•              -                        J-                                  —                     -  -  

\ 

Digital 

,  j  

i 
j 

H-P 

IBM 

j 

j 

i 

NCR 

1 

Safetynet 

SG-RS 



Wang 

 ■  ■  i " ■ " ■ " 

1 

 _  1  1  

Unisys                           |  | 

14.      Please  indicate  the  criticality  of  each  IT  product  category  to  your 
business.  Additionally,  please  indicate  what  you  believe  will  be  the 
criticality  of  each  category  in  2  years  (l=very  low,  5=very  high). 
Please  rotate. 


Criticality 

Criticality  i 

(1-5) 

in  2  years 
^   (1-5)  ^ 

!  Mainframe s/datacentres 

\  Unix  Servers 


I  NT  Servers 

U— :  . —  

I  Proprietary  midrange  (e.g.AS/400s) 


©  1997  by  INPUT  Reproduction  Prohibited 


67 


EVALUATION  OF  BUSINESS  CONTINUITY  SERVICES  IN  THE  U.S.  1997 


INPUT 


1  PC/LANs 

—  

\ 

WANs 

\ 

Telephony  Equipment 

\ 

Printers 

j 

1  Other,  please  specify 

Disaster  Recovery  Services 

15.      \ATiat  do  you  see  as  the  3  major  advantages  of  external  disaster 
recovery  services? 


16.      \^Tiat  do  you  see  as  the  3  major  disadvantages  of  external  disaster 
recovery  services? 


17.      How  will  your  need  for  such  services  change  over  the  next  two 
years? 


18.      Why  will  this  need  occur? 


19.      \Miat  is  the  likelihood  that  you  will  purchase  a  disaster  recovery 
contract  within  the  next  two  years  (l=very  low.  5  very  high)? 


20.      Please  indicate  the  t^T^es  of  disaster  recovery  service  of  which  you 
are  aw^are  and  the  likehhood  that  you  would  purchase  it  within  the 
next  two  years  (l=\'ery  low.  5=very  high). 
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Disaster  Recovery 
Service  Types 

Aware 
(Y/N) 

Likelihood  of 
purchasing 
(1-5)  i 

f  

Hot  Standby/High  Availability 



Warm  Standby 

Cold  Standby 

On-Site  Backup  Service/Mobile 
Units 

Proactive  Business  Continuity  Services 

Proactive  business  continuity  services  are  those  which  seek  to  prevent 
disasters  from  taking  place  or  enable  users  to  deal  with  the  consequences 
more  effectively.  Typical  service  types  include  remote  management 
services  and  contingency  planning. 

21.      What  do  you  see  as  the  3  major  advantages  of  external  proactive 
services? 


What  do  you  see  as  the  3  major  disadvantages  of  external  proactive 
services? 


23.      How  will  your  need  for  such  services  change  over  the  next  two 
years? 


24.      Why  will  this  need  occur? 
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25.      What  is  the  hkehhood  that  you  will  purchase  a  proactive  business 
continuity  services  contract  within  the  next  two  years  (l=very  low, 
5  very  high)? 


26.      Please  indicate  the  types  of  proactive  business  continuity  services 
of  which  you  are  aware  and  the  likehhood  that  you  would  purchase 
it  within  the  next  two  years  (l=very  low,  5=very  high). 


Proactive  Service  Types 

Aware 

Likelihood  of 
purchasing  (1-5) 

Remote  Management 



Virus  Protection/Data  Security 

,  , 

Contingency  Planning  &  Risk 
Analysis 

27.      Please  indicate  the  influence  that  each  of  the  following  would  have 
on  your  organisation's  selection  of  business  continuity  vendor(s) 
(l=low,  5=high). 


Influence  (1-5) 

Managing  Director 

Finance  Director 

IT  Director 

IT  Manager 

— •  

Business  Users 



Internal  Auditors 

External  Auditors 

Regulatory  Body 

Other  (please  specify) 

28.      What  are  the  key  services  that  you  would  expect  a  supplier  of 
business  continuity  services  to  provide? 
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29.  Please  indicate  the  importance  of  the  following  selection  criteria  to 
you  if  you  were  to  choose  a  supplier  of  business  continuity  services 
(l=very  low,  5=very  high). 


Adherence  to  a  published  code  of  conduct 

Membership  of  BCI/  Survive/CSSA  | 

General  support  capability 

Multiplatform  capability 

Network  expertise 

F'inanoial  stabihtv 

Customer  references 

Beinff  an  indenendent  business  continuity 
services  vendor  (e.g.  Comdisco,  SGRS) 

Being  a  large  systems  vendor  (e.g.  Hewlett- 
Packard,  IBM) 

Total  business  continuity  services  provision 

Platform  specific  provision 

Providing  BCS  as  a  part  of  a  managed  services 
or  outsourcing  contract 

Cost  of  service 

Ability  to  offer  'best  of  breed  service' 

Ability  to  tailor  offering  to  specific 
requirements 

Thank  you  for  your  assistance 
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Business  Continuity  Services 
User  Questionnaire,  U.S. 


Definitions 

Business  continuity  services  (BCS)  can  be  described  as  services  that  are 
designed  to  protect  business  critical  activities  underpinned  by  IT  from 
disaster  either  by  providing  the  necessary  facihties  to  continue  those 
activities  in  the  event  of  a  disaster  or  by  preventing  disasters  from 
disrupting  business  critical  activities  in  the  first  place.  BCS  can  be  split 
into  two  types:  disaster  recovery  (DR)  services  and  proactive  business 
continuity  services. 

DR  services  include  a  number  of  services  elements  that  keep  a  business 
running  in  the  event  of  a  major  incident  which  temporarily  puts  its 
operations  completely  out  of  action.  Service  types  include  backup 
services,  restart  services  and  the  provision  of  standby  sites. 

Proactive  business  continuity  services  are  those  which  seek  to  prevent 
disasters  from  taking  place  or  enable  users  to  deal  with  the  consequences 
more  effectively.  Typical  service  types  include  remote  management 
services  and  contingency  planning. 

A  cold  standby  site  is  an  alternative  site,  minus  computer  hardware  or 
office  facilities,  available  for  long  term  use. 

A  warm  standby  site  is  an  alternative  recovery  centre  already  equipped 
and  ready  to  begin  the  process  of  resuming  critical  operations  following  a 
disaster. 

A  hot  standby  site  cuts  recovery  time  to  an  absolute  minimum  by  already 
having  current  data  available,  instead  of  having  to  restore  from  backup 
media.  The  ultimate  manifestation  would  be  a  complete  dedicated 
standby  system. 
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Respondent  Details 


Company  Name 

Respondent  Name 

Job  Title 

Total  Annual  Turnover 

Total  Number  of  Staff 

Total  IT  Budget 

Total  Number  of  IT  Staff 

Industry 


Banking  and  Finance 

Insurance 

Government 

Distribution 

Utilities 

Manufacturing 

Other  (please  specify) 

Screening  Question 

1.        Please  indicate  if  you  currently  use  any  of  the  following  business 
continuity  provisions 




Disaster  Recovery  Services 

1 

Proactive  Business  Continuity 
Services  (e.g.  remote 

management  services) 

:  

If  none  of  the  above,  please  terminate  the  interview  or  switch  to 
non  user  questionnaire. 
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2.  When  did  your  current  business 
continuity  contract  begin 

3.  Why  did  you  purchase  a 
business  continuity  contract? 

4.  From  which  vendor(s)  did  you 
purchase  your  contract? 

5.  Please  estimate  how  much  you 
have  spent  on  Business 
Continuity  contracts  from 
external  vendors  over  the  past 
year. 

6.  Please  estimate  the  proportion 
of  this  sum  that  can  be 
attributed  to  each  equipment 
type  platform  where  applicable. 

%  of Spend  . 

 .J 

Mainframes/datacentres 

Unix  Servers 

NT  Servers 

Proprietary  midrange  (e.g.AS/400s) 

PC/LANs 

WANs 

Telephony  Equipment 

Printers 

Other,  please  specify 
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7.        Please  indicate  the  importance  of  the  following  reasons  for 

purchasing  business  continuity  contracts  now.  Additionally,  please 
indicate  how  important  you  believe  these  reasons  will  be  in  2  years' 
time  (l=very  low  importance,  5=very  high  importance). 


Now  (1-5)  1  In  2  Years 

insuiance  requirement/insurance  l^osl 
Saving 

Credibility  with  shareholders/customers 

Fire/Flood  Risk 

Threat  of  Terrorism 

Year  2000  Issues 

Risk  of  Power  Cuts/Surges 

Failure  of  internal  backups 

Risk  of  Theft 

Risk  of  software  or  hardware  failure 

Internet  security 

Virus  attack 

Data  security 

Increased  use  of  networks 

Other(s)  (please  specify) 

8.        Within  your  organisation,  which  processes/apphcations  are  mission 
critical  and  need  to  be  underpinned  with  external  business 
continuity  services? 


©  1997  by  INPUT  Reproduction  Prohibited 


SC27U 


EVALUATION  OF  BUSINESS  CONTINUITY  SERVICES  IN  THE  U.S.  1997 


INPUT 


9.        Please  indicate  the  influence  that  each  of  the  following  had  on  your 
decision  to  purchase  a  business  continuity  contract(s)  (l=low, 
5=high). 


; 

Influence 

Managing  Director 

1  Finance  Director 

1 — "     ~ — ~ — - — " 

IT  Director 

IT  Manager 

Business  Users 

Internal  Auditors 

i 

External  Auditors 

Regulatory  Body 

Other  (please  specify) 

10.      Please  indicate  whether  or  not  you  are  aware  of  the  following 
vendors  as  business  continuity  vendors.  If  you  are  aware  of  its 
business  continuity  activities,  please  indicate  your  impression  of 
its  business  continuity  capabilities  (l=low  capability,  5=high 
capability).  Please  rotate. 


Aware  (Y/N) 

Capability  (1-5) 

Amdahl 

Cap  Gemini 



SG-RS 

r —  — ' 
Comdisco 

 —   — . — ~~ —  

Data  General 

Digital 

H-P 

IBM 

NCR 

Safetynet 

SG-RS 

Wang 

Unisys 
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11.      Please  indicate  the  3  most  important  attributes  that  you  seek  from 
a  business  continuity  vendor? 


12.      Which  of  the  following  do  you  consider  to  be  important  selection 
criteria  when  choosing  a  potential  Business  Continuity  Services 
Vendor?  Please  indicate  level  of  importance  (l=not  at  all 
important,  5=very  important). 


Adherence  to  a  published  code  of  conduct 

IVlembersmp  oi  rSUi/  burvive/UooA 

General  support  capability 

Multiplatform  capability 

Network  expertise 

Financial  stability 

Customer  references 

Being  an  independent  business  continuity 
services  vendor  (e.g.  Comdisco,  SGRS) 

Being  a  large  systems  vendor  (e.g.  Hewlett- 
Packard,  IBM) 

Total  business  continuity  services  provision 

Platform  specific  provision 

Providing  BCS  as  a  part  of  a  managed  services 
or  outsourcing  contract 

Cost  of  service 

Ability  to  offer  'best  of  breed  service' 

Ability  to  tailor  offering  to  specific 
requirements 
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13.      Please  indicate  your  level  of  satisfaction  with  your  business 
continuity  services  vend.or(s)  (l=very  low  5=very  high) 


Name  of  Vendor 

Satisfaction  (1-5) 



:  ; 

14.      What  do  you  beheve  are  the  3  major  benefits  of  business  continuity 
services  and  to  what  extent  have  each  of  these  been  achieved 
(l=very  low,  5=very  high)? 


Benefit  Achieved  (1-5) 


X 

t 

1 


15.      What  is  the  maximum  downtime  that  you  can  accept? 


0-6  hours 

7-12  hours 

 .  

13-24  hours 

25-48  hours 

49-72  hours 

More  than  72  hours 

16.      In  the  next  two  years,  do  you  believe  that  this  will: 


?   -    

Increase 

Decrease 

1  

Stay  the  same 

- 
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17.      With  which  elements  of  your  business  continuity  services  are  you 
particularly  satisfied  and  why? 


18.      With  which  elements  of  your  business  continuity  services  are  you 
dissatisfied  and  why? 


19.      How  satisfied  are  you  with  each  of  the  following  business 

continuity  service  features  (where  l=very  low,  5=very  high)? 




Access  to  standby  site(s) 

Response  times 

Proactivity 

Ability  of  standby  site(s)  to  enable 
business  continuity 

Remote  management 

Multiplatform  capability 

Network  expertise 

Cost  of  service 

Flexibility 

Support 

20.      Are  there  any  business  continuity  service  activities  that  are  unmet 
by  the  services  organisation  assisting  you? 


!  Yes 

I  No 

21.      If  yes,  what  are  these? 


22.      In  what  way(s)  do  you  think  that  your  business  continuity  services 
could  be  improved? 
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23.      How  do  you  expect  your  business  continuity  requirements  to 
change  over  the  next  two  years? 


Disaster  Recovery  Services 


24.      Does  your  organisation  currently  have  disaster  recovery 
provisions? 


Yes 

No 

25.      How  satisfied  are  you  with  the  DR  service  for  each  type  of 

equipment  that  is  covered  (l=very  low,  5=very  high)?  Additionally, 
please  indicate  whether  you  think  that  the  importance  of  DR 
contracts  will  increase,  decrease  or  stay  the  same  over  the  next  two 
years  for  each  equipment  type? 


■ 

Satisfaction 

1 

Future 

■ 

  .     ......            .  .  ■  ■ . 

Mainframes/datacentres 

(1-5) 

Importance 

Unix  Servers 

NT  Servers 

Proprietary  midrange  (e.g.AS/400s) 

PC/LANs 

WANs 

: 

Telephony  Equipment 

Printers 

:  Other,  please  specify 

26.      How  satisfied  are  you  with  your  alternative  workspace  (l=low% 
5=high) 
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27.      Additionally,  please  indicate  any  way(s)  in  which  this  workspace 
could  be  improved 


28.      Please  indicate  the  extent  to  which  you  use  the  following  recovery 
methods  now  and  your  level  of  satisfaction  with  each  method 
where  applicable  (l=very  low,  5=very  high)?  Additionally,  please 
indicate  whether  your  usage  of  each  method  will  increase,  decrease 
or  stay  the  same  over  the  next  2  years. 


^  

Now 

Satisfaction 

2  Years 

Vaulting 

Mirroring 

Shadowing 

Standby  Systems 

29.      Please  indicate  the  types  of  disaster  recovery  service  you  currently 
have,  your  satisfaction  with  them,  and  if  you  believe  that  usage  of 
these  services  will  increase,  decrease  or  stay  the  same  over  the 
next  two  years.  Additionally,  please  estimate  the  proportion  of 
your  DR  spend  that  can  be  attributed  to  each  DR  service  type. 


Disaster  Recovery 

Have? 

Satisfaction 

Increase,  Decrease 

%  of  DR 

Service  Types 

(1-5) 

or  the  Same  in 
2  yrs 

Spend 

Hot  Standby/high  availability 

Warm  Standby 

Cold  Standby 

On-Site  Backup  Service/Mobile 
Units 

30.      If  applicable,  please  indicate  your 


Hot  standby  response  times 

i 
i 

Warm  standby  response  times 

1 

Cold  standby  response  times 
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31.      Please  estimate  the  annual  cost  of  your  disaster  recovery 
contract(s). 


Proactive  Business  Continuity  Services 

Proactive  business  continuity  services  are  those  which  seek  to  prevent 
disasters  from  taking  place  or  enable  users  to  deal  with  the  consequences 
more  effectively.  Typical  service  types  include  remote  management 
services  and  contingency  planning. 


32.      Does  your  organisation  currently  receive  proactive  business 
continuity  services  from  an  external  vendor? 


Yes 

No 

 i 

i 

33.      If  no,  why  not? 


If  no,  please  terminate  the  interview  and  thank  the  respondent. 

34.      How  satisfied  are  you  with  the  proactive  service  for  each  platform 
that  is  covered  (l=very  low,  5=very  high)?  Additionally,  please 
indicate  whether  you  think  that  the  importance  of  proactive 
services  will  increase,  decrease  or  stay  the  same  over  the  next  two 
years  for  each  platform? 


Mainframes/datacentres 

Satisfaction 
(1-5) 

Future 
Importance 

Unix  Servers 

NT  Servers 

Proprietary  midrange  (e.g.AS/400s) 

PC/LANs 

WANs 

Telephony  Equipment 

Printers 

i 
1 

Other,  please  specify 
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35.      Please  indicate  the  types  of  proactive  services  you  currently  have, 
your  satisfaction  with  them,  and  if  you  beheve  that  usage  of  these 
services  will  increase,  decrease  or  stay  the  same  over  the  next  two 
years.  Additionally,  please  estimate  the  proportion  of  your  spend 
on  proactive  business  continuity  services  that  can  be  attributed  to 
each  proactive  service  type. 


Proactive  Service  Types 

Have? 

Satisfaction 
(1-5) 

Increase, 
Decrease  or 
the  Same  in 

%  of  ' 
Proactive 
Services 

Remote  Management 

2  yrs 

 1 

Spend 



Virus  Protection/Data  Security 



Contingency  Planning  &  Risk 
Analysis 



Other  (specify) 





36.      Please  estimate  the  annual  cost  of  your  proactive  business 
continuity  services  contract. 


Thank  you  very  much  for  your  assistance 
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